phacility/phabricator · error · Exception

Inline comment "%s" is not editable.

Error message

Inline comment "%s" is not editable.

What it means

Thrown by loadCommentByIDForEdit() after the comment loaded successfully but canEditInlineComment($viewer, $inline) returned false. Each application controller implements the edit check; in practice only the comment's author (or users with edit rights over the container object) may edit an inline comment. The exception aborts the edit/preview request — this is a permissions failure on a comment that does exist.

Source

Thrown at src/infrastructure/diff/PhabricatorInlineCommentController.php:531

  final protected function loadCommentByIDForEdit($id) {
    $viewer = $this->getViewer();

    $query = $this->newInlineCommentQuery()
      ->withIDs(array($id))
      ->needInlineContext(true);

    $inline = $this->loadCommentByQuery($query);

    if (!$inline) {
      throw new Exception(
        pht(
          'Unable to load inline "%s".',
          $id));
    }

    if (!$this->canEditInlineComment($viewer, $inline)) {
      throw new Exception(
        pht(
          'Inline comment "%s" is not editable.',
          $id));
    }

    return $inline;
  }

  private function loadCommentByQuery(
    PhabricatorDiffInlineCommentQuery $query) {
    $viewer = $this->getViewer();

    $inline = $query
      ->setViewer($viewer)
      ->executeOne();

    if ($inline) {
      $inline = $inline->newInlineCommentObject();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Only edit comments authored by the acting user; ask the author to edit, or reply instead
2. If administrative editing is truly required, run as the author (e.g. via `bin/user` impersonation tooling) rather than rewriting policy
3. For custom integrations, check canEditInlineComment() logic in your subclass (DifferentialInlineCommentEditController::canEditInlineComment) if the rule is wrong for your install

// Before rendering edit controls for an inline comment
$can_edit = $viewer->getPHID() === $inline->getAuthorPHID();
if (!$can_edit) {
  // render read-only view / reply link instead of an edit action
}

try {
  $inline = $this->loadCommentByIDForEdit($id);
} catch (Exception $ex) {
  // covers both 'not loadable' and 'not editable': respond 403/404
  return new Aphront403Response();
}

When it happens

Trigger: A non-author opening the edit endpoint for someone else's inline comment (e.g. `/differential/comment/inline/edit/{id}/` by URL manipulation); the author acting after the comment was reassigned or the viewer context changed; administrative scripts running as a viewer who is not the author.

Common situations: Users hand-editing URLs to modify others' review comments; automation replaying an edit request under a service account instead of the author; policy customization that narrows inline edit rights.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Unable to load inline "%s".
• Failed to load container object for inline comment.
• Failed to load comment "%s".
• Attempting to update comment content state, but request has
• Request parameter "%s" is not formatted properly. Expected a

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/ca160b8cc182740f. Report an issue: GitHub.